commit 2056c7e39548a1106b2f0101fdfd3fb8b7510479 · pyrox.dev/nixpkgs

+12 -20
nixos/modules/services/security/vault.nix
···

       7
       7
        
         configFile = pkgs.writeText "vault.hcl" ''

     

       8
       8
        
           listener "tcp" {

     

       9
       9
        
             address = "${cfg.address}"

     

       10
       10
       -
             tls_cert_file = "${cfg.tlsCertFile}"

     

       11
       11
       -
             tls_key_file = "${cfg.tlsKeyFile}"

     

       10
       10
       +
             ${if (cfg.tlsCertFile == null || cfg.tlsKeyFile == null) then ''

     

       11
       11
       +
                 tls_disable = "true"

     

       12
       12
       +
               '' else ''

     

       13
       13
       +
                 tls_cert_file = "${cfg.tlsCertFile}"

     

       14
       14
       +
                 tls_key_file = "${cfg.tlsKeyFile}"

     

       15
       15
       +
               ''}

     

       12
       16
        
             ${cfg.listenerExtraConfig}

     

       13
       17
        
           }

     

       14
       18
        
           storage "${cfg.storageBackend}" {

     
···

       35
       39
        
             };

     

       36
       40
        
       

     

       37
       41
        
             tlsCertFile = mkOption {

     

       38
       38
       -
               type = types.str;

     

       39
       39
       -
               default = "/etc/vault/cert.pem";

     

       42
       42
       +
               type = types.nullOr types.str;

     

       43
       43
       +
               default = null;

     

       40
       44
        
               example = "/path/to/your/cert.pem";

     

       41
       41
       -
               description = "TLS certificate file. A self-signed certificate will be generated if file not exists";

     

       45
       45
       +
               description = "TLS certificate file. TLS will be disabled unless this option is set";

     

       42
       46
        
             };

     

       43
       47
        
       

     

       44
       48
        
             tlsKeyFile = mkOption {

     

       45
       45
       -
               type = types.str;

     

       46
       46
       -
               default = "/etc/vault/key.pem";

     

       49
       49
       +
               type = types.nullOr types.str;

     

       50
       50
       +
               default = null;

     

       47
       51
        
               example = "/path/to/your/key.pem";

     

       48
       48
       -
               description = "TLS private key file. A self-signed certificate will be generated if file not exists";

     

       52
       52
       +
               description = "TLS private key file. TLS will be disabled unless this option is set";

     

       49
       53
        
             };

     

       50
       54
        
       

     

       51
       55
        
             listenerExtraConfig = mkOption {

     
···

       109
       113
        
       

     

       110
       114
        
             preStart = optionalString (localDir != null) ''

     

       111
       115
        
               install -d -m0700 -o vault -g vault "${localDir}"

     

       112
       112
       -
             '' + ''

     

       113
       113
       -
               # generate a self-signed certificate, you will have to set environment variable "VAULT_SKIP_VERIFY=1" in the client

     

       114
       114
       -
               if [ ! -s ${cfg.tlsCertFile} -o ! -s ${cfg.tlsKeyFile} ]; then

     

       115
       115
       -
                 mkdir -p $(dirname ${cfg.tlsCertFile}) || true

     

       116
       116
       -
                 mkdir -p $(dirname ${cfg.tlsKeyFile }) || true

     

       117
       117
       -
                 ${pkgs.openssl.bin}/bin/openssl req -x509 -newkey rsa:2048 -sha256 -nodes -days 99999 \

     

       118
       118
       -
                   -subj /C=US/ST=NY/L=NYC/O=vault/CN=${cfg.address} \

     

       119
       119
       -
                   -keyout ${cfg.tlsKeyFile} -out ${cfg.tlsCertFile}

     

       120
       120
       -
       

     

       121
       121
       -
                 chown root:vault ${cfg.tlsKeyFile} ${cfg.tlsCertFile}

     

       122
       122
       -
                 chmod 440 ${cfg.tlsKeyFile} ${cfg.tlsCertFile}

     

       123
       123
       -
               fi

     

       124
       116
        
             '';

     

       125
       117
        
       

     

       126
       118
        
             serviceConfig = {